refactor(runtime): make the permission privilege ladder an explicit rank (#3303)

* fix(runtime): prompt permission mode never invokes the prompter

PermissionMode derives Ord from declaration order, placing Prompt (and Allow)
above the real privilege ladder (ReadOnly < WorkspaceWrite < DangerFullAccess).
In PermissionPolicy::authorize_with_context the ladder check
'current_mode >= required_mode' therefore evaluates true for every tool when the
active mode is Prompt (3 >= {0,1,2}), returning Allow and making the subsequent
'if current_mode == PermissionMode::Prompt' branch that routes to prompt_or_deny
unreachable.

Effect: a session configured with the 'prompt' permission mode silently
auto-allows every tool and never calls the prompter (reached via
ConversationRuntime::run_turn with an interactive prompter), defeating the mode's
entire purpose. The sibling PermissionEnforcer already special-cases Prompt
before its own 'active_mode >= required_mode' check, confirming Prompt is not
meant to be part of the ordered ladder.

Fix: exclude Prompt from the ordered-ladder comparison so Prompt mode falls
through to the interactive prompt path. Allow remains handled by its explicit
equality check. The same comparison appears twice in authorize_with_context —
once in the shared tail and once inside the 'Some(PermissionOverride::Allow)'
arm, which is reached when a hook emits permissionDecision "allow" — so both
copies carry the guard; guarding only the tail still left a hook able to
auto-allow every tool in Prompt mode without ever consulting the prompter.

Adds regression tests covering Prompt mode with a prompter, without a prompter,
and with a hook allow override.

* refactor(runtime): make the permission privilege ladder an explicit rank

`PermissionMode` derived `PartialOrd`/`Ord`, so the ladder deciding whether a
tool runs without asking was declaration order. A variant inserted in the middle
of the enum re-ranked it silently, and the difference between "this tool may
run" and "this tool may run after a prompt" was a property of where an `enum`
line happened to sit. That is how `Prompt` came to outrank `DangerFullAccess`,
satisfy `current_mode >= required_mode` for every tool, and skip the prompter.

Replace the derive with `privilege_rank`, an exhaustive `match` naming every
variant, so inserting one is a build failure rather than a silent re-ranking.
`Ord` is deliberately not derived, so a stray `>=` on two modes no longer
compiles; the two comparisons outside this module now say which rank they read
(`PermissionEnforcer::check_with_required_mode` and the `claw doctor` permission
check). Both keep their previous answers, since `privilege_rank` reproduces the
old declaration order exactly, including `Prompt` and `Allow` above the tiers.

`Prompt` and `Allow` are modes of operation, not privilege tiers, so they are
never ranked *against* a tool requirement. The new `covers` predicate states
that by name rather than by number: `Allow` always covers, `Prompt` never does
(it asks), and only the three tiers compare ranks.

That also collapses the duplicated ladder in `authorize_with_context`. The
`Some(PermissionOverride::Allow)` arm carried a second, identical copy of the
ask-rule check and the ladder; it now falls through to the single copy below,
so a hook `allow` is an override rather than a bypass and the two copies can no
longer drift apart.

Behaviour is unchanged for every (mode, requirement, rule, override)
combination. The tests pin the `Prompt` routes — plain and hook-`allow` — across
all three tiers, plus the rank ordering itself.

rust/crates/runtime/src/permission_enforcer.rs

@@ -81,8 +81,10 @@ impl PermissionEnforcer {
 
         let active_mode = self.policy.active_mode();
 
-        // Check if active mode meets the dynamically determined required mode
-        if active_mode >= required_mode {
+        // Check if active mode meets the dynamically determined required mode.
+        // Ranked explicitly: `PermissionMode` no longer derives `Ord`, so the
+        // ladder is a named function rather than declaration order.
+        if active_mode.privilege_rank() >= required_mode.privilege_rank() {
             return EnforcementResult::Allowed;
         }
 

rust/crates/runtime/src/permissions.rs

@@ -5,7 +5,10 @@ use serde_json::Value;
 use crate::config::RuntimePermissionRuleConfig;
 
 /// Permission level assigned to a tool invocation or runtime session.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+///
+/// Deliberately **not** `PartialOrd`/`Ord`: see [`PermissionMode::privilege_rank`]
+/// for why ordering is a named function here rather than declaration order.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum PermissionMode {
     ReadOnly,
     WorkspaceWrite,
@@ -25,6 +28,53 @@ impl PermissionMode {
             Self::Allow => "allow",
         }
     }
+
+    /// Position on the privilege ladder used by [`PermissionPolicy`].
+    ///
+    /// This is the only ranking, and `Ord` is intentionally not derived, so a
+    /// stray `active_mode >= required_mode` no longer compiles. Ranking through
+    /// declaration order meant a variant inserted in the middle of the enum
+    /// silently re-ranked the ladder, and the difference between "this tool may
+    /// run" and "this tool may run after a prompt" was therefore a property of
+    /// where an `enum` line happened to sit. Every variant is named here, so an
+    /// insertion is a build failure instead of a silent re-ranking; the two
+    /// comparisons outside this module that do read a rank — the
+    /// `PermissionEnforcer`'s `check_with_required_mode` and the `claw doctor`
+    /// permission check — now say so at the call site.
+    ///
+    /// `Prompt` and `Allow` are *modes of operation*, not privilege tiers. They
+    /// rank above every tier so those two callers keep the answers they had, but
+    /// they are never ranked *against* a tier: see [`Self::covers`].
+    #[must_use]
+    pub const fn privilege_rank(self) -> u8 {
+        match self {
+            Self::ReadOnly => 0,
+            Self::WorkspaceWrite => 1,
+            Self::DangerFullAccess => 2,
+            Self::Prompt => 3,
+            Self::Allow => 4,
+        }
+    }
+
+    /// Whether a session running in `self` may use a tool that requires
+    /// `required` without asking.
+    ///
+    /// Only tiers answer this by rank. `Allow` never asks and `Prompt` always
+    /// asks — it is the exact opposite of a silent allow — so neither is a
+    /// statement about how much of the workspace the session may touch, and
+    /// comparing either to `required` is comparing a mode to a tier. That
+    /// comparison is what let `Prompt`, which outranks `DangerFullAccess`, make
+    /// the ladder return `Allow` for every tool and skip the prompter entirely.
+    #[must_use]
+    pub const fn covers(self, required: Self) -> bool {
+        match self {
+            Self::Allow => true,
+            Self::Prompt => false,
+            Self::ReadOnly | Self::WorkspaceWrite | Self::DangerFullAccess => {
+                self.privilege_rank() >= required.privilege_rank()
+            }
+        }
+    }
 }
 
 /// Hook-provided override applied before standard permission evaluation.
@@ -236,29 +286,12 @@ impl PermissionPolicy {
                     prompter,
                 );
             }
-            Some(PermissionOverride::Allow) => {
-                if let Some(rule) = ask_rule {
-                    let reason = format!(
-                        "tool '{tool_name}' requires approval due to ask rule '{}'",
-                        rule.raw
-                    );
-                    return Self::prompt_or_deny(
-                        tool_name,
-                        input,
-                        current_mode,
-                        required_mode,
-                        Some(reason),
-                        prompter,
-                    );
-                }
-                if allow_rule.is_some()
-                    || current_mode == PermissionMode::Allow
-                    || current_mode >= required_mode
-                {
-                    return PermissionOutcome::Allow;
-                }
-            }
-            None => {}
+            // A hook `allow` is an override, not a bypass: the ask-rule check
+            // and the privilege ladder below still run for it. Both used to be
+            // spelled out a second time inside this arm, which is why the ladder
+            // existed in two copies that had to be corrected in step — and the
+            // second copy is exactly what a fix for one of them is easy to miss.
+            Some(PermissionOverride::Allow) | None => {}
         }
 
         if let Some(rule) = ask_rule {
@@ -276,10 +309,10 @@ impl PermissionPolicy {
             );
         }
 
-        if allow_rule.is_some()
-            || current_mode == PermissionMode::Allow
-            || current_mode >= required_mode
-        {
+        // The ladder, in one place. An `allow` rule is an explicit grant for
+        // this tool and outranks the mode; otherwise the mode decides through
+        // [`PermissionMode::covers`].
+        if allow_rule.is_some() || current_mode.covers(required_mode) {
             return PermissionOutcome::Allow;
         }
 
@@ -587,6 +620,132 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn prompt_mode_routes_to_prompter_instead_of_auto_allowing() {
+        // Regression: `Prompt` sorts above `DangerFullAccess` in the
+        // `PermissionMode` `Ord` derivation, so the `current_mode >= required_mode`
+        // ladder check used to auto-allow every tool in `Prompt` mode and never
+        // invoke the prompter — defeating the entire purpose of the mode.
+        let policy = PermissionPolicy::new(PermissionMode::Prompt)
+            .with_tool_requirement("read_file", PermissionMode::ReadOnly);
+        let mut prompter = RecordingPrompter {
+            seen: Vec::new(),
+            allow: true,
+        };
+
+        let outcome = policy.authorize("read_file", "{}", Some(&mut prompter));
+
+        assert_eq!(outcome, PermissionOutcome::Allow);
+        assert_eq!(prompter.seen.len(), 1);
+        assert_eq!(prompter.seen[0].tool_name, "read_file");
+        assert_eq!(prompter.seen[0].current_mode, PermissionMode::Prompt);
+    }
+
+    #[test]
+    fn prompt_mode_denies_when_no_prompter_is_available() {
+        let policy = PermissionPolicy::new(PermissionMode::Prompt)
+            .with_tool_requirement("read_file", PermissionMode::ReadOnly);
+
+        assert!(matches!(
+            policy.authorize("read_file", "{}", None),
+            PermissionOutcome::Deny { .. }
+        ));
+    }
+
+    #[test]
+    fn prompt_mode_prompts_for_every_privilege_tier() {
+        // The ladder used to exist twice — once on the plain path and once inside
+        // the `Some(PermissionOverride::Allow)` arm — so a hook emitting
+        // `permissionDecision: "allow"` (see `hooks.rs`) had its own route to the
+        // auto-allow. Sweeping the tiers against both routes keeps them honest now
+        // that they are one predicate.
+        for required in [
+            PermissionMode::ReadOnly,
+            PermissionMode::WorkspaceWrite,
+            PermissionMode::DangerFullAccess,
+        ] {
+            for override_decision in [None, Some(PermissionOverride::Allow)] {
+                let policy = PermissionPolicy::new(PermissionMode::Prompt)
+                    .with_tool_requirement("read_file", required);
+                let context = PermissionContext::new(
+                    override_decision,
+                    override_decision.map(|_| "hook approved".to_string()),
+                );
+                let mut prompter = RecordingPrompter {
+                    seen: Vec::new(),
+                    allow: true,
+                };
+
+                let outcome =
+                    policy.authorize_with_context("read_file", "{}", &context, Some(&mut prompter));
+
+                assert_eq!(
+                    outcome,
+                    PermissionOutcome::Allow,
+                    "an approving prompter must still pass a {required:?} tool"
+                );
+                assert_eq!(
+                    prompter.seen.len(),
+                    1,
+                    "prompt mode skipped the prompter for a {required:?} tool \
+                     (override = {override_decision:?})"
+                );
+                assert_eq!(prompter.seen[0].tool_name, "read_file");
+                assert_eq!(prompter.seen[0].current_mode, PermissionMode::Prompt);
+                assert_eq!(prompter.seen[0].required_mode, required);
+            }
+        }
+    }
+
+    #[test]
+    fn privilege_rank_orders_the_privilege_tiers() {
+        assert!(
+            PermissionMode::ReadOnly.privilege_rank()
+                < PermissionMode::WorkspaceWrite.privilege_rank()
+        );
+        assert!(
+            PermissionMode::WorkspaceWrite.privilege_rank()
+                < PermissionMode::DangerFullAccess.privilege_rank()
+        );
+    }
+
+    #[test]
+    fn privilege_rank_places_the_operating_modes_above_every_tier() {
+        // `Prompt` and `Allow` are modes of operation rather than tiers, so
+        // `covers` answers for them by name and never consults this number. They
+        // still have to rank above every tier, because two callers outside this
+        // module — the `PermissionEnforcer`'s `check_with_required_mode` and the
+        // `claw doctor` permission check — compare ranks, and a `Prompt`/`Allow`
+        // session must keep the result it had under the old derived `Ord`.
+        for mode in [PermissionMode::Prompt, PermissionMode::Allow] {
+            assert!(
+                mode.privilege_rank() > PermissionMode::DangerFullAccess.privilege_rank(),
+                "{mode:?} must outrank danger-full-access"
+            );
+            assert!(
+                mode.privilege_rank() > PermissionMode::WorkspaceWrite.privilege_rank(),
+                "{mode:?} must outrank workspace-write"
+            );
+        }
+    }
+
+    #[test]
+    fn covers_never_compares_an_operating_mode_against_a_tier() {
+        for required in [
+            PermissionMode::ReadOnly,
+            PermissionMode::WorkspaceWrite,
+            PermissionMode::DangerFullAccess,
+        ] {
+            assert!(
+                !PermissionMode::Prompt.covers(required),
+                "prompt mode must ask before running a {required:?} tool"
+            );
+        }
+        assert!(PermissionMode::Allow.covers(PermissionMode::DangerFullAccess));
+        assert!(PermissionMode::DangerFullAccess.covers(PermissionMode::WorkspaceWrite));
+        assert!(!PermissionMode::WorkspaceWrite.covers(PermissionMode::DangerFullAccess));
+    }
+
     #[test]
     fn applies_rule_based_denials_and_allows() {
         let rules = RuntimePermissionRuleConfig::new(

rust/crates/rusty-claude-cli/src/main.rs

@@ -4222,15 +4222,18 @@ fn check_permission_health(permission_mode: PermissionModeProvenance) -> Diagnos
         || source.to_string(),
         |env_var| format!("{source}:{env_var}"),
     );
+    // Ranks, not declaration order: `PermissionMode` deliberately does not
+    // derive `Ord`, so the ladder is named at every comparison site.
     let specs = mvp_tool_specs();
+    let active_rank = permission_mode.mode.privilege_rank();
     let tools_satisfied = specs
         .iter()
-        .filter(|spec| permission_mode.mode >= spec.required_permission)
+        .filter(|spec| active_rank >= spec.required_permission.privilege_rank())
         .map(|spec| spec.name)
         .collect::<Vec<_>>();
     let tools_gated = specs
         .iter()
-        .filter(|spec| permission_mode.mode < spec.required_permission)
+        .filter(|spec| active_rank < spec.required_permission.privilege_rank())
         .map(|spec| spec.name)
         .collect::<Vec<_>>();